Extracted

• • Target
    fc2631c62f5aadf52a4f83289493d04a5ab8a108d004eb6a55eacbf98df41f08.exe
  • Size 23KB
  • SHA256 fc2631c62f5aadf52a4f83289493d04a5ab8a108d004eb6a55eacbf98df41f08
  • MD5 bb7170cddabbe302e36414eb9ecae880
  • SHA1 6a1a0a3f40ff9b81c8e75436fc1465aaca719d63
  • SHA512 1132f0b9d71c6810314eb626ababe5dae936852e7bb78e35a8d81455226bc9689f2711dae9908bbfc4720b06c95a7d652990dc43884697d82d8ac950cfe98a1f
  • SSDEEP 384:oc6ze6e1PAhJVzC3tC1im/BsTx46PgZ0rap9HBmRvR6JZlbw8hqIusZzZkV6:ce9EJLN/yRpcnuG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  njratdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealertrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies RDP port number used by Windows

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Stops running service(s)

    evasionexecution

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  behavioral1behavioral2